Information about a cyber security incident
On 28 September 2024, we discovered that an unauthorised third party illegally gained access to a small part of our IT network. This is called a cyberattack.
We continue to work with security experts to investigate this attack. Our in-built security defences have protected council services which are all operating as normal.
This incident has impacted relatively few people in the borough. They are mainly housing customers and leaseholders, who we are contacting directly.
However, we appreciate this may be worrying so we have created a list of Frequently Asked Questions (FAQs) below which will provide further information and offer some reassurance.
We will update the FAQs as more details become available.
The council takes your privacy seriously and we are committed to protecting and respecting the rights of all individuals.
We apologise for any concern this incident has caused.
About the cyberattack
On September 28, 2024, we discovered that an unauthorized third party had accessed a small part of our IT network. This part contained information about some housing customers and leaseholders.
What is a cyberattack?
A cyberattack is when someone illegally tries to steal, expose, change, disable, or destroy data or systems by accessing a network, computer, or digital device without permission.
Who was behind the cyberattack?
We do not know who was responsible or why they did it. No one has claimed responsibility or contacted the council since we discovered the attack. Unfortunately, cyberattacks are common, especially against large organizations and public bodies.
What information was accessed?
The attacker accessed a small part of our network with limited information mainly about housing disrepair, leaseholder properties, and homelessness applications. We do not believe they were specifically looking for this data or targeting individuals.
Which council services have been impacted?
We are confident that no council services have been affected. Residents can continue to access all services as usual.
What actions have the council taken?
We immediately took steps to contain the cyberattack and prevent further access. We hired a cybersecurity firm to review our systems and recommend additional protections. We also notified the relevant authorities, including the Information Commissioner and the National Cyber Security Centre. Anyone affected has been contacted directly by letter or email. We continue to assess any risks for those impacted.
Why are you informing the public now?
We needed to take several steps before making this incident public. This included checking our systems for other threats, understanding who might be affected, and coordinating with the National Cyber Security Centre and the Information Commissioner’s Office. We also needed to put extra security measures in place. We are now notifying everyone whose information was accessed.
Is it safe to continue to make payments or save personal details with the council?
Yes, it is safe to send and receive emails from enfield.gov.uk addresses and to open attachments we send. Standing orders and direct debits are not affected.
Will the cyber attacker use my personal data?
We have no evidence that the attacker has used or published any information about our residents or customers. There is no reason to believe the attack was focused on specific individuals. However, we suggest remaining cautious and we will continue to monitor the situation.
I have not received a letter but is there anything I need to do?
If you were affected, you will receive a letter or email with information and advice on what to do next.
However, it is always sensible to remain vigilant to identify fraud:
- Advice on actions to take following a data breach is on the National Cyber Security Centre's website
- Information about how to protect yourself against identity fraud can be found on the Experian website
- Check the Have I Been Pwned website to see if your data has been compromised in other breaches
- Register your phone numbers with the Telephone Preference Service
Contacting us
If your data was accessed, you will have been contacted directly.
For more information, read our privacy notice and information on personal data rights.
If you have concerns or want us to erase your data, email complaintsandinformation@enfield.gov.uk.